Exclusive: Logically Investigation Uncovers QAnon Central Hub Hosting Phishing Scams; Direct Ties to Jim Watkins

Investigation by Nick Backovic and Joe Ondrak.
Supporting research by Kristina Gildejeva.

***

• A Logically Investigation reveals that QAnon communications are being consolidated under the control of Jim Watkins, through US based hosting company VanwaTech.

• Based in Vancouver, Washington, VanwaTech hosts only a handful of websites unrelated to QAnon, including the neo-Nazi website The Daily Stormer.

• The connection with Watkins was previously assumed, but our investigation reveals concrete evidence.

• VanwaTech also hosts several phishing sites posing as UK banks and cellular phone service providers, aiming to defraud customers of money.

• Since the removal of QMap, VanwaTech’s operators have made a concerted effort to  develop the company into a safe haven for the aggregator sites that disseminate the conspiracy material at the heart of QAnon.

In September, Logically unveiled an in-depth investigation into qmap.pub, a high-traffic QAnon aggregator website that facilitated access to posts written by the so-called “Q,” an anonymous figure claiming to be a military intelligence officer working closely with President Donald Trump to fight a “deep state” cabal of child-trafficking elites. Since originating on the 4chan image board in 2017, QAnon has since gone on to become a super-conspiracy theory, linked to several violent incidents and mutating to spread within different countries and demographics. It was recently implicated in attacks on New Jersey Congressman Tom Malinowski who received multiple death threats after leading a bipartisan resolution against the movement.

With approximately 10 million visitors per month, QMap was by far the most visited website for Q-drops. Our report revealed that the website had been operated by Jason Gelinas, a CitiGroup information security specialist from New Jersey who earned $3,000 USD per month in donations to a Patreon account he operated under the name qappanon, which was itself registered to the LLC Patriot Platforms. After the publication of our report, Bloomberg’s William Turton reached out to Gelinas about his involvement in QMap, to which Gelinas responded that QAnon was a “patriotic movement to save the country.” QMap was subsequently taken down and Gelinas was fired from CitiGroup following an internal investigation. 

QMap’s disappearance highlighted something most QAnon researchers have known for quite some time: the efficiency of Q’s disinformation campaign relies heavily—if not entirely—on these aggregators, which make the drops not only easier to find but also palatable to those who would be otherwise unwilling to go read them at the source. The original sources of Q drops, 4chan, 8chan and later 8kun can be quite off-putting places. While sites such as 8kun offer the Q drops in their original setting, aggregator sites like QMap offer a sheltered, mom-friendly version, removed from the immediate vulgarity of the source image board sites. And while QMap was by far the most visited QAnon aggregator site of the current Q era, it was by no means the only one; as reported by the BBC’s Shayan Sardarizadeh, since the fall of QMap, several aggregators have stepped up in its stead, enjoying a significant boost in traffic as a result. 

Jim Watkins, Nick Lim, and Vanwatech

Before its owner took the website down, QMap had used the services of Washington state based web hosting and DDOS protection company VanwaTech, which also hosts the 8kun image board. In recent weeks, other Q-drop aggregators such as qagg.news and qalerts.app (now also duplicated as inteldrops.com) have also been switching over to VanwaTech, with qagg.news’s migration happening as recently as early October. Suspicion has long been levied at Jim Watkins—a pig farmer from the Philippines who owns the 8chan and 8kun image boards—in regard to his alleged prominent role in the history of QAnon’s spread, and it has also been speculated that Watkins has a hand in VanwaTech itself.

VanwaTech is owned by CEO Nick Lim, who himself is no stranger to controversy. When 8chan was dumped by previous hosting company Cloudflare in 2019, it was Lim’s company, Bitmitigate, that came to the rescue to get the site back online. Lim paints himself as a protector of free speech, and operates VanwaTech as a safe haven for ‘controversial’ platforms—some of which include hate speech (Lim’s clients include the notorious neo-Nazi website The Daily Stormer). When asked about his permissive stance with regard to controversial content, Lim told Bloomberg: “If it’s legal, I don’t care.” 

Aside from its main customers—the Watkins-run image boards, the QAnon aggregator sites, and The Daily Stormer—VanwaTech’s client list remains remarkably thin. Our investigation shows that not only has VanwaTech made a push to become a centralized hub for QAnon aggregators, but that—contrary to Lim’s attempts to draw a line between controversy and illegality—VanwaTech’s newest clients are, by definition, not endeavours operating within the boundaries of the law. 

Phishing scams

Our investigation uncovered a number of phishing sites posing as UK banks and cell phone service providers—such as Halifax, HSBC, Giff Gaff, and Three—have also joined Vanwatech’s client list in recent weeks. Phishing scams are designed to trick unsavvy internet users into clicking on links that may appear familiar and secure, but are in fact used to gain access to the user’s valuable personal information such as addresses and bank details. As of October 12th, the VanwaTech IP in the image below listed 49 shared domains, 15 of which are directly related to QAnon and the image boards; and 11 of which are, quite evidently, phishing scams. 

The Jim Watkins Connection

Creator of 8chan Fredrick Brennan, who has long disavowed the platform and been working to expose Jim Watkins’s involvement in the spread and weaponization of QAnon, told Logically that although there’s been speculation that Watkins’s ties to VanwaTech amounted to more than just shared interests and a client-business relationship, these assertions have lacked substantial evidence until now.  Records obtained by Logically reveal that the partnership between Jim Watkins and Vanwatech goes beyond just a loose affiliation. In a version of VanwaTech’s terms of use, we found that Jim Watkins’s IsItWetYet Inc. owns VanwaTech’s “deep web proxy software,” thus showing a far more meaningful partnership than previously proven, and revealing that any use of this VanwaTech software must also abide by terms set by Watkins, which, in the document presented are: "... ... ... ..."

A centralized QAnon hub

Further records obtained by Logically also show exchanges on VanwaTech’s Discord channel prior to the fall of QMap (the channel was  set to private after QMap was taken down by its owner), revealing that the developers behind several of the aggregators remain in close communication both with each other and with Lim. The developers behind aggregators such as qalerts.app and qagg.news, who go by the name of DevAnon and TechmasterQ respectively, can be seen interacting with a user assumed to be Lim (based on his previous use of the handle Lao Tzu) and comparing notes on the functionality of their Q-drop aggregator sites. Much like Gelinas and QMap, the aggregators mentioned here are more than just die-hard Q fans enjoying their downtime with a harmless hobby: their impact on the Q movement—which has led to several incidents of real-world harm—is substantial. The QAnon aggregator developer known as ResignationAnon, an IT specialist based in Germany and creator of ResignationList, has recently been coordinating efforts to translate QAnon material into foreign languages, a role previously occupied by QMap. Meanwhile DevAnon, a Tea Party supporter, Oath Keeper, and sales software developer, saw traffic to his aggregator site qalerts.app more than double from August to September.

Between Watkins, VanwaTech, and the developers behind these aggregators, we can see a tremendous amount of  influence over the QAnon world. While the Q-sphere repeatedly encourages followers to ‘do their own research,’ it is now more clear than ever that a centralized hub featuring only a handful of players has the ability to dictate what that ‘research’ should be and in what direction it goes. Given that the QAnon army of followers is so dependent on the ‘knowledge’ that is controlled by essentially a few small groups of people, the power that this centralized hub wields is enormous.

What this means

While the question of who Q really is remains a point of intrigue amongst those interested in the global spread of QAnon, it’s important to remember that by now, the answer doesn’t matter that much. Realistically, even if we were to present you with a grand reveal unmasking Q, the reality is that this movement has become too big for that to even make a dent: the movement has long left the image board sites and is now reaching worried moms as a kind of  folklore, often with no mention of Q itself but only the disinformation the movement disseminates. What does matter, however, is that a centralized core has the ability to ‘be Q’ at any moment—and that they have an army of loyal followers at their disposal. Given that the U.S. is three weeks away from an election and the groundwork has already been laid to contest the legitimacy of the results, it’s very easy to imagine a scenario in which this central hub, or Watkins himself, can wield disproportionate influence on how Americans react after November 3rd. And that, in itself, should be truly terrifying.

*Logically reached out to Nick Lim and the developers known as ResignationAnon and DevAnon. None have taken the opportunity to comment as of the time of publication. 

28/7/2021 CORRECTION: A previous version of this article listed ResignationAnon as being present in VanWaTech's Discord Chats. Although he was the admin of ResignationList and was involved in qresearch, he was not present in the Discord group.